Blog hacked – unauthorized posts

I’ve had somebody create a draft post on my blog and I can’t figure out how they did it. I know who it was based on the content of the post. I have no idea how they managed to do it as I updated my password a few months ago with a strong password created in LastPass. Post-by-email is disbaled, so it can’t have been done that way. It happened a few weeks ago, and then again again a couple weeks later. The original draft was also moved into the trash when the second one was created. I’ve since installed an activity log plugin in case it happens again. Any help with this would be appreciated.